diff --git a/nixos/modules/services/desktop-managers/gnome.nix b/nixos/modules/services/desktop-managers/gnome.nix
index 0cc84d435766..dc9f8c11b138 100644
--- a/nixos/modules/services/desktop-managers/gnome.nix
+++ b/nixos/modules/services/desktop-managers/gnome.nix
@@ -320,6 +320,8 @@ in
 
     (lib.mkIf serviceCfg.core-os-services.enable {
       hardware.bluetooth.enable = mkDefault true;
+      i18n.inputMethod.enable = mkDefault true;
+      i18n.inputMethod.type = mkDefault "ibus";
       programs.dconf.enable = true;
       security.polkit.enable = true;
       security.rtkit.enable = mkDefault true;
diff --git a/nixos/modules/services/misc/n8n.nix b/nixos/modules/services/misc/n8n.nix
index e54d9c19f745..a112786cc2d9 100644
--- a/nixos/modules/services/misc/n8n.nix
+++ b/nixos/modules/services/misc/n8n.nix
@@ -61,7 +61,7 @@ in
             readOnly = true;
           };
           N8N_DIAGNOSTICS_ENABLED = lib.mkOption {
-            type = with lib.types; coercedTo bool toString str;
+            type = with lib.types; coercedTo bool builtins.toJSON str;
             default = false;
             description = ''
               Whether to share selected, anonymous telemetry with n8n.
@@ -69,7 +69,7 @@ in
             '';
           };
           N8N_VERSION_NOTIFICATIONS_ENABLED = lib.mkOption {
-            type = with lib.types; coercedTo bool toString str;
+            type = with lib.types; coercedTo bool builtins.toJSON str;
             default = false;
             description = ''
               When enabled, n8n sends notifications of new versions and security updates.
diff --git a/nixos/tests/n8n.nix b/nixos/tests/n8n.nix
index 4697760bb292..61216b7b0ac4 100644
--- a/nixos/tests/n8n.nix
+++ b/nixos/tests/n8n.nix
@@ -25,5 +25,6 @@ in
     machine.succeed("grep -qF ${webhookUrl} /etc/systemd/system/n8n.service")
     machine.succeed("grep -qF 'HOME=/var/lib/n8n' /etc/systemd/system/n8n.service")
     machine.fail("grep -qF 'GENERIC_TIMEZONE=' /etc/systemd/system/n8n.service")
+    machine.succeed("grep -qF 'N8N_DIAGNOSTICS_ENABLED=false' /etc/systemd/system/n8n.service")
   '';
 }
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index f7ac5d8cf7be..cb1d0a38f813 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -24,8 +24,8 @@ let
     sha256Hash = "sha256-ciu+To5Kcus8FPDz1D43AD+qOqfPHaW4JsEBr9fx2PE=";
   };
   latestVersion = {
-    version = "2025.2.3.5"; # "Android Studio Otter 3 Feature Drop | 2025.2.3 Canary 5"
-    sha256Hash = "sha256-gqJXOO7kW4orfsfCn5xOqLSpGu5apH4MpDhLAuOAG5w=";
+    version = "2025.3.1.1"; # "Android Studio Panda 1 | 2025.3.1 Canary 1"
+    sha256Hash = "sha256-hCWt8wMxqA4So/oZL6RzRRY3Kg6vAYr9xDAzQ/5ZXow=";
   };
 in
 {
diff --git a/pkgs/applications/emulators/libretro/cores/ppsspp.nix b/pkgs/applications/emulators/libretro/cores/ppsspp.nix
index b2f9a6c8783d..2676741e3e54 100644
--- a/pkgs/applications/emulators/libretro/cores/ppsspp.nix
+++ b/pkgs/applications/emulators/libretro/cores/ppsspp.nix
@@ -13,13 +13,13 @@
 }:
 mkLibretroCore {
   core = "ppsspp";
-  version = "0-unstable-2025-12-16";
+  version = "0-unstable-2025-12-22";
 
   src = fetchFromGitHub {
     owner = "hrydgard";
     repo = "ppsspp";
-    rev = "dd112491db181114723fed270a1c45ffc1355539";
-    hash = "sha256-NMUpmJySZPcyo/niIohxbXG5MfkyKCdeEF9O8ZPKe8g=";
+    rev = "036013ef87d2ac6b9fea36dbb513617c72e11254";
+    hash = "sha256-T2fUq6Iah/vQ/NaGPE/wa2sJL888VKRpdiNq7hbFsWI=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index a12216d1ae8e..61e83abacf38 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -310,11 +310,11 @@
     "vendorHash": null
   },
   "digitalocean_digitalocean": {
-    "hash": "sha256-V5Ss2GbxDqxm1I3NgqyLkg8B7iK+5tICdJ28YeCiEgM=",
+    "hash": "sha256-A6LxX2zMZAd/Db1VdAVqMplCW2qZx4MNyIpLwTBXkxU=",
     "homepage": "https://registry.terraform.io/providers/digitalocean/digitalocean",
     "owner": "digitalocean",
     "repo": "terraform-provider-digitalocean",
-    "rev": "v2.71.0",
+    "rev": "v2.72.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -842,13 +842,13 @@
     "vendorHash": "sha256-Y1L1nIOubhBN5vNIXY7miQgR9OzoTCS7QA55DEMwDSA="
   },
   "linode_linode": {
-    "hash": "sha256-AxG8N/kEu2+Yym63Ac04SxjrUyCiSp/zmIXQqscpeWM=",
+    "hash": "sha256-gsRrEsR2+2AadSPhY6hwP3iqjNQyCqhxmnsFL2iMbcw=",
     "homepage": "https://registry.terraform.io/providers/linode/linode",
     "owner": "linode",
     "repo": "terraform-provider-linode",
-    "rev": "v3.6.0",
+    "rev": "v3.7.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-2zdUEV84CQ236ktTfMcucAb2gwDPIQ+Br5AfKncZdJA="
+    "vendorHash": "sha256-03uqpurO11HMMxwZRIaD7iuOYk6TuGbztIwE5SPwemU="
   },
   "loafoe_htpasswd": {
     "hash": "sha256-ALTyTTVyS2HHenmk8HVwtQenCmJX05kyXifJTzzmnHE=",
diff --git a/pkgs/applications/video/mpv/scripts/sponsorblock-minimal.nix b/pkgs/applications/video/mpv/scripts/sponsorblock-minimal.nix
index 9b38977da3bb..6bbc22cd4cd6 100644
--- a/pkgs/applications/video/mpv/scripts/sponsorblock-minimal.nix
+++ b/pkgs/applications/video/mpv/scripts/sponsorblock-minimal.nix
@@ -9,15 +9,15 @@
 
 buildLua {
   pname = "mpv_sponsorblock_minimal";
-  version = "0-unstable-2025-09-09";
+  version = "0-unstable-2025-12-21";
   scriptPath = "sponsorblock_minimal.lua";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "jouni";
     repo = "mpv_sponsorblock_minimal";
-    rev = "fc0db1fbffc873ca02ced7602274393fde8857e5";
-    hash = "sha256-DOgJ1gZybfIFJQ5qt4B93ugHz1o+RJ7E8Cnb7itYfTs=";
+    rev = "8f4b186d6ea46e6fe0e5e94a53dda2f50dceb576";
+    hash = "sha256-21qucigVnEaniQh7BKwFG/PDkwV51q0kzqe0ipVH6qY=";
   };
   passthru.updateScript = unstableGitUpdater { };
 
diff --git a/pkgs/build-support/fetchgithub/default.nix b/pkgs/build-support/fetchgithub/default.nix
index 1283dcd7d25a..a08f6d5de12b 100644
--- a/pkgs/build-support/fetchgithub/default.nix
+++ b/pkgs/build-support/fetchgithub/default.nix
@@ -4,8 +4,40 @@
   fetchgit,
   fetchzip,
 }:
+let
+  # Here defines fetchFromGitHub arguments that determines useFetchGit,
+  # The attribute value is their default values.
+  # As fetchFromGitHub prefers fetchzip for hash stability,
+  # `defaultFetchGitArgs` attributes should lead to `useFetchGit = false`.
+  useFetchGitArgsDefault = {
+    deepClone = false;
+    fetchSubmodules = false; # This differs from fetchgit's default
+    fetchLFS = false;
+    forceFetchGit = false;
+    leaveDotGit = null;
+    rootDir = "";
+    sparseCheckout = null;
+  };
+  useFetchGitArgsDefaultNullable = {
+    leaveDotGit = false;
+    sparseCheckout = [ ];
+  };
 
-lib.makeOverridable (
+  useFetchGitargsDefaultNonNull = useFetchGitArgsDefault // useFetchGitArgsDefaultNullable;
+
+  # useFetchGitArgsWD to exclude from automatic passing.
+  # Other useFetchGitArgsWD will pass down to fetchgit.
+  excludeUseFetchGitArgNames = [
+    "forceFetchGit"
+  ];
+
+  faUseFetchGit = lib.mapAttrs (_: _: true) useFetchGitArgsDefault;
+
+  adjustFunctionArgs = f: lib.setFunctionArgs f (faUseFetchGit // lib.functionArgs f);
+
+  decorate = f: lib.makeOverridable (adjustFunctionArgs f);
+in
+decorate (
   {
     owner,
     repo,
@@ -13,21 +45,12 @@ lib.makeOverridable (
     rev ? null,
     # TODO(@ShamrockLee): Add back after reconstruction with lib.extendMkDerivation
     # name ? repoRevToNameMaybe finalAttrs.repo (lib.revOrTag finalAttrs.revCustom finalAttrs.tag) "github",
-    # `fetchFromGitHub` defaults to use `fetchzip` for better hash stability.
-    # We default not to fetch submodules, which is contrary to `fetchgit`'s default.
-    fetchSubmodules ? false,
-    leaveDotGit ? null,
-    deepClone ? false,
     private ? false,
-    forceFetchGit ? false,
-    fetchLFS ? false,
-    rootDir ? "",
-    sparseCheckout ? null,
     githubBase ? "github.com",
     varPrefix ? null,
     passthru ? { },
     meta ? { },
-    ... # For hash agility
+    ... # For hash agility and additional fetchgit arguments
   }@args:
 
   assert (
@@ -37,6 +60,16 @@ lib.makeOverridable (
   );
 
   let
+    useFetchGit =
+      lib.mapAttrs (
+        name: nonNullDefault:
+        if args ? ${name} && (useFetchGitArgsDefaultNullable ? ${name} -> args.${name} != null) then
+          args.${name}
+        else
+          nonNullDefault
+      ) useFetchGitargsDefaultNonNull != useFetchGitargsDefaultNonNull;
+
+    useFetchGitArgsWDPassing = lib.overrideExisting (removeAttrs useFetchGitArgsDefault excludeUseFetchGitArgNames) args;
 
     position = (
       if args.meta.description or null != null then
@@ -56,26 +89,19 @@ lib.makeOverridable (
         # to indicate where derivation originates, similar to make-derivation.nix's mkDerivation
         position = "${position.file}:${toString position.line}";
       };
-    passthruAttrs = removeAttrs args [
-      "owner"
-      "repo"
-      "tag"
-      "rev"
-      "fetchSubmodules"
-      "forceFetchGit"
-      "private"
-      "githubBase"
-      "varPrefix"
-    ];
+    passthruAttrs = removeAttrs args (
+      [
+        "owner"
+        "repo"
+        "tag"
+        "rev"
+        "private"
+        "githubBase"
+        "varPrefix"
+      ]
+      ++ (if useFetchGit then excludeUseFetchGitArgNames else lib.attrNames faUseFetchGit)
+    );
     varBase = "NIX${lib.optionalString (varPrefix != null) "_${varPrefix}"}_GITHUB_PRIVATE_";
-    useFetchGit =
-      fetchSubmodules
-      || lib.defaultTo false leaveDotGit == true
-      || deepClone
-      || forceFetchGit
-      || fetchLFS
-      || (rootDir != "")
-      || lib.defaultTo [ ] sparseCheckout != [ ];
     # We prefer fetchzip in cases we don't need submodules as the hash
     # is more stable in that case.
     fetcher =
@@ -118,16 +144,9 @@ lib.makeOverridable (
       passthruAttrs
       // (
         if useFetchGit then
-          {
-            inherit
-              tag
-              rev
-              deepClone
-              fetchSubmodules
-              leaveDotGit
-              sparseCheckout
-              fetchLFS
-              ;
+          useFetchGitArgsWDPassing
+          // {
+            inherit tag rev;
             url = gitRepoUrl;
             inherit passthru;
             derivationArgs = {
diff --git a/pkgs/by-name/at/atlas/package.nix b/pkgs/by-name/at/atlas/package.nix
index e7295ec77842..9f85f579387b 100644
--- a/pkgs/by-name/at/atlas/package.nix
+++ b/pkgs/by-name/at/atlas/package.nix
@@ -9,19 +9,19 @@
 
 buildGoModule (finalAttrs: {
   pname = "atlas";
-  version = "0.38.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "ariga";
     repo = "atlas";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OS0UYrE+5spErR/S+7AsYDPcCce3EEWvcBBKh+8FkTo=";
+    hash = "sha256-Ls5N6HZFR3+KfuqoyE6gaaxhjZ/stQC+g1kWIUE8EaE=";
   };
 
   modRoot = "cmd/atlas";
 
   proxyVendor = true;
-  vendorHash = "sha256-xlKU/hxSjQWSQV++7RHfY4hZhm2tWCPS6DcyaGNnmhc=";
+  vendorHash = "sha256-ksSvW+Sc1iQlMf9i6GWMjq4hISdAD3t/uAPlQ3x7wHU=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/bo/bootdev-cli/package.nix b/pkgs/by-name/bo/bootdev-cli/package.nix
index 4e4b71af8cb0..3521a7e628ba 100644
--- a/pkgs/by-name/bo/bootdev-cli/package.nix
+++ b/pkgs/by-name/bo/bootdev-cli/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "bootdev-cli";
-  version = "1.21.1";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "bootdotdev";
     repo = "bootdev";
     tag = "v${version}";
-    hash = "sha256-1uPI//w8RVqwRO1sVkI3vtdXduyuFp8632CVyAjkaSA=";
+    hash = "sha256-Fk82JKD8zHRPBoliwnvQKqZNii7TiX13cKENXw5011E=";
   };
 
   vendorHash = "sha256-jhRoPXgfntDauInD+F7koCaJlX4XDj+jQSe/uEEYIMM=";
diff --git a/pkgs/by-name/cd/cdncheck/package.nix b/pkgs/by-name/cd/cdncheck/package.nix
index 513d3ece2651..78a466362442 100644
--- a/pkgs/by-name/cd/cdncheck/package.nix
+++ b/pkgs/by-name/cd/cdncheck/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "cdncheck";
-  version = "1.2.14";
+  version = "1.2.15";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${version}";
-    hash = "sha256-6U0NaNohokLcNcC+WLKHJfQ/duUsIr2iCTpzH0CzHCQ=";
+    hash = "sha256-o6QPCv8c8ssMyKqcZN3HfbnEGy7Wps104pKL+3d+RNk=";
   };
 
-  vendorHash = "sha256-bOYBSbaXRmBn8eHu25xDgkmQoPw6IwbvLyQitOJP4so=";
+  vendorHash = "sha256-sS91wOiFUH6dh3O6icTRnwHRIq5Q1B+j9j33IUehAc0=";
 
   subPackages = [ "cmd/cdncheck/" ];
 
diff --git a/pkgs/by-name/do/dolibarr/package.nix b/pkgs/by-name/do/dolibarr/package.nix
index 6b21b14b1144..9dfba98b1fb9 100644
--- a/pkgs/by-name/do/dolibarr/package.nix
+++ b/pkgs/by-name/do/dolibarr/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dolibarr";
-  version = "22.0.3";
+  version = "22.0.4";
 
   src = fetchFromGitHub {
     owner = "Dolibarr";
     repo = "dolibarr";
     tag = finalAttrs.version;
-    hash = "sha256-3dcui1A8EzcFogQfUkf9+8A1C1CcFxHPFjOybDLKaCY=";
+    hash = "sha256-jk1sjVZJvFeJtQjxgNRx+WLSDsevMvxUIFCO4JMPEHM=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/ea/easyeffects/package.nix b/pkgs/by-name/ea/easyeffects/package.nix
index e0962dbb811d..c8404e721196 100644
--- a/pkgs/by-name/ea/easyeffects/package.nix
+++ b/pkgs/by-name/ea/easyeffects/package.nix
@@ -59,13 +59,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "easyeffects";
-  version = "8.0.8";
+  version = "8.0.9";
 
   src = fetchFromGitHub {
     owner = "wwmm";
     repo = "easyeffects";
     tag = "v${version}";
-    hash = "sha256-Pw9rMYHrRBSttdtElWDH1YOF0tNWgb2zBzJBI9jJe4Q=";
+    hash = "sha256-cFMbeJeEIDP7uiNi+rRKErgHtjP/PbPKASo+M2qogZQ=";
   };
 
   patches = [ ./qmlmodule-fix.patch ];
diff --git a/pkgs/by-name/go/go-passbolt-cli/package.nix b/pkgs/by-name/go/go-passbolt-cli/package.nix
index 6ec961336a9b..758107f8e537 100644
--- a/pkgs/by-name/go/go-passbolt-cli/package.nix
+++ b/pkgs/by-name/go/go-passbolt-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "go-passbolt-cli";
-  version = "0.3.2";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "passbolt";
     repo = "go-passbolt-cli";
     rev = "v${version}";
-    hash = "sha256-BtMPOmp9dbi/HoNigEeGWIYXRh1/gorV8ycrtWw9I8s=";
+    hash = "sha256-DTgvhmNzfr7ZXjVn+znXqFL+0bHBeGofFE521H7RUI4=";
   };
 
-  vendorHash = "sha256-wGSrhW7OsSjHlSKLkOf2AYIxU1m2lM1WGUsy16qxBwA=";
+  vendorHash = "sha256-QLTKCb3hl/0JFO2XKfLiOtnwfR/v+WqUx4vuaO/MoXo=";
 
   ldflags = [
     "-X=main.version=${version}"
diff --git a/pkgs/by-name/go/golines/package.nix b/pkgs/by-name/go/golines/package.nix
index 0c7a02bc81cc..2f1f7d1888c7 100644
--- a/pkgs/by-name/go/golines/package.nix
+++ b/pkgs/by-name/go/golines/package.nix
@@ -17,6 +17,10 @@ buildGoModule rec {
 
   vendorHash = "sha256-94IXh9iBAE0jJXovaElY8oFdXE6hxYg0Ww0ZEHLnEwc=";
 
+  subPackages = [
+    "."
+  ];
+
   meta = {
     description = "Golang formatter that fixes long lines";
     homepage = "https://github.com/segmentio/golines";
diff --git a/pkgs/by-name/hm/hmcl/package.nix b/pkgs/by-name/hm/hmcl/package.nix
index 8125460cb02f..2c705e4b9a0c 100644
--- a/pkgs/by-name/hm/hmcl/package.nix
+++ b/pkgs/by-name/hm/hmcl/package.nix
@@ -39,13 +39,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hmcl";
-  version = "3.8.1";
+  version = "3.8.2";
 
   src = fetchurl {
     # HMCL has built-in keys, such as the Microsoft OAuth secret and the CurseForge API key.
     # See https://github.com/HMCL-dev/HMCL/blob/refs/tags/release-3.6.12/.github/workflows/gradle.yml#L26-L28
     url = "https://github.com/HMCL-dev/HMCL/releases/download/v${finalAttrs.version}/HMCL-${finalAttrs.version}.jar";
-    hash = "sha256-mQ0iuIOVRETdueNbe5s9USbis6IB6n0eA2EzsMzyGng=";
+    hash = "sha256-0vAgyN8PC2AQbor9aVqr/K1oBLt4QGpEQ2vSL2ajQOg=";
   };
 
   # - HMCL prompts users to download prebuilt Terracotta binary for
diff --git a/pkgs/by-name/ht/htb-toolkit/package.nix b/pkgs/by-name/ht/htb-toolkit/package.nix
index f778fc1a2074..3087e66da289 100644
--- a/pkgs/by-name/ht/htb-toolkit/package.nix
+++ b/pkgs/by-name/ht/htb-toolkit/package.nix
@@ -16,14 +16,14 @@
 
 rustPlatform.buildRustPackage {
   pname = "htb-toolkit";
-  version = "0-unstable-2025-08-12";
+  version = "0-unstable-2025-12-19";
 
   src = fetchFromGitHub {
     owner = "D3vil0p3r";
     repo = "htb-toolkit";
     # https://github.com/D3vil0p3r/htb-toolkit/issues/3
-    rev = "60996a88fbd5e8aeab78005e754ef37d95ffdba4";
-    hash = "sha256-u+IigAs/W0lzp9kCW43TkjHTIrPCkGdmva6tesQq/Pk=";
+    rev = "4f1c6bded11d8c907c951fcbe63f1fc44568a9f9";
+    hash = "sha256-pkZ5KVSgtrWfXhJ3knmyOIArIjyAjMmm5WcrrB2pCKY=";
   };
 
   cargoHash = "sha256-ReEe8pyW66GXIPwAy6IKsFEAUjxHmzw5mj21i/h4quQ=";
diff --git a/pkgs/by-name/ir/ironbar/package.nix b/pkgs/by-name/ir/ironbar/package.nix
index 2db15bec9319..7dfade94684e 100644
--- a/pkgs/by-name/ir/ironbar/package.nix
+++ b/pkgs/by-name/ir/ironbar/package.nix
@@ -1,5 +1,5 @@
 {
-  gtk3,
+  gtk4,
   gdk-pixbuf,
   librsvg,
   webp-pixbuf-loader,
@@ -8,11 +8,10 @@
   glib,
   shared-mime-info,
   gsettings-desktop-schemas,
-  wrapGAppsHook3,
-  gtk-layer-shell,
+  wrapGAppsHook4,
+  gtk4-layer-shell,
   adwaita-icon-theme,
   libxkbcommon,
-  libdbusmenu-gtk3,
   openssl,
   pkg-config,
   hicolor-icon-theme,
@@ -26,6 +25,7 @@
   libevdev,
   features ? [ ],
   systemd,
+  dbus,
 }:
 
 let
@@ -33,22 +33,22 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "ironbar";
-  version = "0.17.1";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "JakeStanger";
     repo = "ironbar";
     rev = "v${version}";
-    hash = "sha256-aph9onWsaEYJqz1bcBNijEexnH0MPLtoblpU9KSbksA=";
+    hash = "sha256-vhkNdvzY9xd8qmKgKtpVRTdvmS1QxnGKDFCpttqX1GE=";
   };
 
-  cargoHash = "sha256-puBoRdCd1A8FmEu5PmczgYAdPdTA8FA1CWsh7qWjHzQ=";
+  cargoHash = "sha256-ptzq0407IaNrXXiksQKXDUbs2wPTz4GHtnCG49EbOcY=";
 
   buildInputs = [
-    gtk3
+    gtk4
     gdk-pixbuf
     glib
-    gtk-layer-shell
+    gtk4-layer-shell
     glib-networking
     shared-mime-info
     adwaita-icon-theme
@@ -56,11 +56,11 @@ rustPlatform.buildRustPackage rec {
     gsettings-desktop-schemas
     libxkbcommon
     systemd
+    dbus
   ]
   ++ lib.optionals (hasFeature "http") [ openssl ]
   ++ lib.optionals (hasFeature "volume") [ libpulseaudio ]
   ++ lib.optionals (hasFeature "cairo") [ luajit ]
-  ++ lib.optionals (hasFeature "tray") [ libdbusmenu-gtk3 ]
   ++ lib.optionals (hasFeature "keyboard") [
     libinput
     libevdev
@@ -68,10 +68,10 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     pkg-config
-    wrapGAppsHook3
+    wrapGAppsHook4
     gobject-introspection
   ];
-  propagatedBuildInputs = [ gtk3 ];
+  propagatedBuildInputs = [ gtk4 ];
 
   runtimeDeps = [ luajitPackages.lgi ];
 
@@ -86,7 +86,7 @@ rustPlatform.buildRustPackage rec {
     --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
 
     # gtk-launch
-    --suffix PATH : "${lib.makeBinPath [ gtk3 ]}"
+    --suffix PATH : "${lib.makeBinPath [ gtk4 ]}"
   ''
   + lib.optionalString (hasFeature "cairo") ''
     --prefix LUA_PATH : "./?.lua;${luajitPackages.lgi}/share/lua/5.1/?.lua;${luajitPackages.lgi}/share/lua/5.1/?/init.lua;${luajit}/share/lua/5.1/\?.lua;${luajit}/share/lua/5.1/?/init.lua"
diff --git a/pkgs/by-name/ki/kickstart/package.nix b/pkgs/by-name/ki/kickstart/package.nix
index cc1b9a81c8ce..05151ec200d7 100644
--- a/pkgs/by-name/ki/kickstart/package.nix
+++ b/pkgs/by-name/ki/kickstart/package.nix
@@ -2,23 +2,22 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  versionCheckHook,
   nix-update-script,
-  testers,
-  kickstart,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "kickstart";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "Keats";
     repo = "kickstart";
-    rev = "v${version}";
-    hash = "sha256-4POxv6fIrp+wKb9V+6Y2YPx3FXp3hpnkq+62H9TwGII=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WrImCnXkFaPUTMBhNaUgX6PsQS1H9zj6jZ8MbgYCGCM=";
   };
 
-  cargoHash = "sha256-J9sGXJbGbO9UgZfgqxqzbiJz9j6WMpq3qC2ys7OJnII=";
+  cargoHash = "sha256-Km49POZwVS2vYmELG5f7kenKQwaHlMP/bZA5cZ995mE=";
 
   buildFeatures = [ "cli" ];
 
@@ -28,19 +27,22 @@ rustPlatform.buildRustPackage rec {
     "--skip=generation::tests::can_generate_from_remote_repo"
   ];
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
   passthru = {
     updateScript = nix-update-script { };
-    tests.version = testers.testVersion {
-      package = kickstart;
-    };
   };
 
   meta = {
     description = "Scaffolding tool to get new projects up and running quickly";
     homepage = "https://github.com/Keats/kickstart";
-    changelog = "https://github.com/Keats/kickstart/releases/tag/v${version}";
+    changelog = "https://github.com/Keats/kickstart/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ gaelreyrol ];
     mainProgram = "kickstart";
   };
-}
+})
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index 5047b1a9aa63..7b9178f65744 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -74,13 +74,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "7445";
+  version = "7527";
 
   src = fetchFromGitHub {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-oHQtfGu1altWwHUl4z2ApLVp8ISfd+l9t+k5NqtbWgA=";
+    hash = "sha256-Nl4l812wZvqZs1Y7HOAf2g9zXLY4EwvfxX+So0tdT0U=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > $out/COMMIT
diff --git a/pkgs/by-name/lu/lux-cli/package.nix b/pkgs/by-name/lu/lux-cli/package.nix
index 5fab05f62913..740eec364586 100644
--- a/pkgs/by-name/lu/lux-cli/package.nix
+++ b/pkgs/by-name/lu/lux-cli/package.nix
@@ -18,18 +18,18 @@
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lux-cli";
 
-  version = "0.22.2";
+  version = "0.22.3";
 
   src = fetchFromGitHub {
     owner = "lumen-oss";
     repo = "lux";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Pae3oifx3G0mouSJL6W/XHGlozmHn6Aj9a8aqTshmVc=";
+    hash = "sha256-YtDo6Njv8Cz8GWlSt1wKQjR9cUDPeru6F+V4g1lO640=";
   };
 
   buildAndTestSubdir = "lux-cli";
 
-  cargoHash = "sha256-XObaVcTbE3pXZurFDt/7jHZUg0TZulV0QwWktqvjAyk=";
+  cargoHash = "sha256-zggaQyzMJm0lI1qHa4Q5o9lMgSy29cp5HJMHqplpe6E=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/ma/matrix-conduit/package.nix b/pkgs/by-name/ma/matrix-conduit/package.nix
index 5cc269af4c56..2ebbe05c03fc 100644
--- a/pkgs/by-name/ma/matrix-conduit/package.nix
+++ b/pkgs/by-name/ma/matrix-conduit/package.nix
@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-conduit";
-  version = "0.10.9";
+  version = "0.10.10";
 
   src = fetchFromGitLab {
     owner = "famedly";
     repo = "conduit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rJyuR8Ie/JiNKNjQL21+Q1PWliEAm+lwGraGeDxEHyY=";
+    hash = "sha256-n2k5SDzxafO+nqc0NhX/6GfSPsF9e/qO9aA7VWqSLuk=";
   };
 
   patches = [
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ./fix_validate_event_fields_for_invites_over_federation.patch
   ];
 
-  cargoHash = "sha256-4ZA+3f8Kt+1JAm9KXnMRxAF+X9z8HSJoJe6Ny63SlnA=";
+  cargoHash = "sha256-WprzCSm0O9Cav9WbikeNV5ZMqxlCY4qez03n0lu5KI8=";
 
   # Conduit enables rusqlite's bundled feature by default, but we'd rather use our copy of SQLite.
   preBuild = ''
diff --git a/pkgs/by-name/mi/misconfig-mapper/package.nix b/pkgs/by-name/mi/misconfig-mapper/package.nix
index 04b15ca9bdb6..639e07b885f2 100644
--- a/pkgs/by-name/mi/misconfig-mapper/package.nix
+++ b/pkgs/by-name/mi/misconfig-mapper/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "misconfig-mapper";
-  version = "1.14.14";
+  version = "1.14.16";
 
   src = fetchFromGitHub {
     owner = "intigriti";
     repo = "misconfig-mapper";
     tag = "v${version}";
-    hash = "sha256-5tugmwr1TyBa89a/yrch+cshyoiJ3uj4EoweltN5d/0=";
+    hash = "sha256-/i1LElC2Yl8dzVOg0OX0CHR1d/01/nK9RVPsKzNvl9o=";
   };
 
-  vendorHash = "sha256-pLhc3Lc8Mp5ZRmNvac3qdQcw1rPQs7bbn4K0UHp04Qs=";
+  vendorHash = "sha256-N9fBmBBq18D+Bbag+SKGDIupGH2b4paWjFiXc1m50n4=";
 
   ldflags = [
     "-s"
@@ -25,7 +25,7 @@ buildGoModule rec {
   meta = {
     description = "Tool to uncover security misconfigurations on popular third-party services";
     homepage = "https://github.com/intigriti/misconfig-mapper";
-    changelog = "https://github.com/intigriti/misconfig-mapper/releases/tag/v${version}";
+    changelog = "https://github.com/intigriti/misconfig-mapper/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "misconfig-mapper";
diff --git a/pkgs/by-name/mk/mktxp/package.nix b/pkgs/by-name/mk/mktxp/package.nix
index 3c2c4855bb8e..e1ecc170bd3e 100644
--- a/pkgs/by-name/mk/mktxp/package.nix
+++ b/pkgs/by-name/mk/mktxp/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
 }:
 let
-  version = "1.2.14";
+  version = "1.2.16";
 in
 python3Packages.buildPythonApplication {
   pname = "mktxp";
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication {
     owner = "akpw";
     repo = "mktxp";
     tag = "v${version}";
-    hash = "sha256-4+0aw/r71FcVrxASco3AkYzi7zbFeiEkJB7acGdb1FQ=";
+    hash = "sha256-jxXpgHSwqtbaj2oyPyWif8rr4fZNNo+ACRTFZ7aWQPc=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/by-name/po/portfolio/package.nix b/pkgs/by-name/po/portfolio/package.nix
index ee474f7d738f..bed3f21f2ce0 100644
--- a/pkgs/by-name/po/portfolio/package.nix
+++ b/pkgs/by-name/po/portfolio/package.nix
@@ -34,11 +34,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "PortfolioPerformance";
-  version = "0.80.4";
+  version = "0.81.0";
 
   src = fetchurl {
     url = "https://github.com/buchen/portfolio/releases/download/${finalAttrs.version}/PortfolioPerformance-${finalAttrs.version}-linux.gtk.x86_64.tar.gz";
-    hash = "sha256-IVaowzXl1WKa5wvQiT+Zub81Kxp57JOfb5cZ8egM2q4=";
+    hash = "sha256-j1FoN35ESHfUxS2zBc/ugoDnp92QRdJX86Bhy/q26A0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/po/postcss/package.nix b/pkgs/by-name/po/postcss/package.nix
new file mode 100644
index 000000000000..6e55d512b3c5
--- /dev/null
+++ b/pkgs/by-name/po/postcss/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchPnpmDeps,
+  nodejs,
+  pnpm,
+  pnpmConfigHook,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "postcss";
+  version = "8.5.6";
+
+  src = fetchFromGitHub {
+    owner = "postcss";
+    repo = "postcss";
+    tag = finalAttrs.version;
+    hash = "sha256-7oGCDqKwJG49DXDiyEZaO8EhxZS/Up5PO3/uqqOa+Bo=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpmConfigHook
+    pnpm
+  ];
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    fetcherVersion = 3;
+    hash = "sha256-WJTQjlOkzCSqPHkNuT/Dn1BOFyL+3lDSl7RW0S9fakU=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    rm -rf node_modules
+    pnpm install --production --offline --force
+    mkdir -p $out/lib/node_modules/postcss
+    mv ./* $out/lib/node_modules/postcss
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/postcss/postcss/releases/tag/${finalAttrs.version}";
+    description = "Transforming styles with JS plugins";
+    homepage = "https://postcss.org/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pyrox0 ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/tb/tbls/package.nix b/pkgs/by-name/tb/tbls/package.nix
index a4e0d3b2255d..53095476c91b 100644
--- a/pkgs/by-name/tb/tbls/package.nix
+++ b/pkgs/by-name/tb/tbls/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "tbls";
-  version = "1.92.1";
+  version = "1.92.2";
 
   src = fetchFromGitHub {
     owner = "k1LoW";
     repo = "tbls";
     tag = "v${version}";
-    hash = "sha256-78YEBMwizGax6V88r9f6FI03GagI3znTnGHh1C0VAVc=";
+    hash = "sha256-pdbUQ9Zds/z1tSIU9R4njF/Ls3DwoRteY7sI7yMv9+I=";
   };
 
   vendorHash = "sha256-mQE1ZGNKbD9XQMoVBU3JVBjEIt0V0+PiC5yps4aj+kQ=";
diff --git a/pkgs/by-name/wi/widelands/package.nix b/pkgs/by-name/wi/widelands/package.nix
index 692cab29ced2..8a2ba417c0a6 100644
--- a/pkgs/by-name/wi/widelands/package.nix
+++ b/pkgs/by-name/wi/widelands/package.nix
@@ -30,23 +30,15 @@
 
 stdenv.mkDerivation rec {
   pname = "widelands";
-  version = "1.2.1";
+  version = "1.3";
 
   src = fetchFromGitHub {
     owner = "widelands";
     repo = "widelands";
     rev = "v${version}";
-    sha256 = "sha256-/MEeb0KnefK812w5y238Icd4gW85d/pvZ08xnlVXDdk=";
+    sha256 = "sha256-943/pkxiIbhnZQMwMNpeu5KKkS+j58zU6r9i6mZGSMg=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "modern-asio.patch";
-      url = "https://codeberg.org/wl/widelands/pulls/5025.patch";
-      sha256 = "sha256-ip9ZG9u/z7G+yG7xrEvi+DH9vsjRzYWhEe0rEjxHzzY=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace xdg/org.widelands.Widelands.desktop \
       --replace 'Exec=widelands' "Exec=$out/bin/widelands"
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index 42d2fffba3a7..87c0b23de599 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -1917,7 +1917,7 @@ builtins.intersectAttrs super {
         nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.buildPackages.makeBinaryWrapper ];
         postInstall = (old.postInstall or "") + ''
           nodePath=""
-          for p in "$out" "${pkgs.nodePackages.postcss}" $plugins; do
+          for p in "$out" "${pkgs.postcss}" $plugins; do
             nodePath="$nodePath''${nodePath:+:}$p/lib/node_modules"
           done
           makeWrapper "$out/bin/tailwindcss" "$out/bin/tailwind" --prefix NODE_PATH : "$nodePath"
diff --git a/pkgs/development/libraries/vigra/default.nix b/pkgs/development/libraries/vigra/default.nix
index 46d4965c105f..14760defa896 100644
--- a/pkgs/development/libraries/vigra/default.nix
+++ b/pkgs/development/libraries/vigra/default.nix
@@ -22,13 +22,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "vigra";
-  version = "1.12.2";
+  version = "1.12.3";
 
   src = fetchFromGitHub {
     owner = "ukoethe";
     repo = "vigra";
     tag = "Version-${lib.replaceStrings [ "." ] [ "-" ] finalAttrs.version}";
-    hash = "sha256-E+O5NbDX1ycDJTht6kW8JzYnhEL6Wd1xp0rcLpdm2HQ=";
+    hash = "sha256-pknZHHIIhjfOxdp+qCOOGvo0W5ByTHXRiIQzzN7Z6M4=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/node-packages/aliases.nix b/pkgs/development/node-packages/aliases.nix
index b6a1f90d49d9..9cb5a2685750 100644
--- a/pkgs/development/node-packages/aliases.nix
+++ b/pkgs/development/node-packages/aliases.nix
@@ -283,6 +283,7 @@ mapAliases {
   inherit (pkgs) pm2; # added 2024-01-22
   inherit (pkgs) pnpm; # added 2024-06-26
   poor-mans-t-sql-formatter-cli = throw "'poor-mans-t-sql-formatter-cli' has been removed because it was unmaintained upstream"; # Added 2025-11-14
+  inherit (pkgs) postcss; # Added 2025-12-24
   postcss-cli = throw "postcss-cli has been removed because it was broken"; # added 2025-03-24
   prebuild-install = throw "prebuild-install was removed because it appeared to be unmaintained upstream. See upstream's recommendations for alternatives here: https://github.com/prebuild/prebuild-install#note"; # Added 2025-12-14
   inherit (pkgs) prettier; # added 2025-05-31
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index f5dda4fdd2eb..46b3f6a85d37 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -18,7 +18,6 @@
 , "js-yaml"
 , "lcov-result-merger"
 , "node2nix"
-, "postcss"
 , "sass"
 , "semver"
 , "vercel"
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index bc19ca668283..b6ee2bc1c6a2 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -20996,29 +20996,6 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-  postcss = nodeEnv.buildNodePackage {
-    name = "postcss";
-    packageName = "postcss";
-    version = "8.5.3";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/postcss/-/postcss-8.5.3.tgz";
-      sha512 = "dle9A3yYxlBSrt8Fu+IpjGT8SY8hN0mlaA6GY8t0P5PjIOZemULz/E2Bnm/2dcUOena75OTNkHI76uZBNUUq3A==";
-    };
-    dependencies = [
-      sources."nanoid-3.3.9"
-      sources."picocolors-1.1.1"
-      sources."source-map-js-1.2.1"
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "Tool for transforming styles with JS plugins";
-      homepage = "https://postcss.org/";
-      license = "MIT";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
   sass = nodeEnv.buildNodePackage {
     name = "sass";
     packageName = "sass";
diff --git a/pkgs/development/python-modules/aiodocker/default.nix b/pkgs/development/python-modules/aiodocker/default.nix
index 7380b62f4869..db1bf4cea30a 100644
--- a/pkgs/development/python-modules/aiodocker/default.nix
+++ b/pkgs/development/python-modules/aiodocker/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "aiodocker";
-  version = "0.24.0";
+  version = "0.25.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = "aiodocker";
     tag = "v${version}";
-    hash = "sha256-qCOAM4ZyJoLc91FjQpBO97Nyfo1ZOEi0nhXZ7nwLsHk=";
+    hash = "sha256-SaPTMpMljAh/6Km/JrbEjAOm30gBHH2QBkj7At/BTBA=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/aioqsw/default.nix b/pkgs/development/python-modules/aioqsw/default.nix
index 08011c184299..aa97da656f53 100644
--- a/pkgs/development/python-modules/aioqsw/default.nix
+++ b/pkgs/development/python-modules/aioqsw/default.nix
@@ -3,31 +3,24 @@
   aiohttp,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonOlder,
   setuptools,
-  wheel,
 }:
 
 buildPythonPackage rec {
   pname = "aioqsw";
-  version = "0.4.1";
-  format = "pyproject";
-
-  disabled = pythonOlder "3.11";
+  version = "0.4.2";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Noltari";
     repo = "aioqsw";
     tag = version;
-    hash = "sha256-h/rTwMF3lc/hWwpzCvK6UMq0rjq3xkw/tEY3BqOPS2s=";
+    hash = "sha256-SIdEM5YxPnCM6wEJTL19t07Xb89wDAwHzKnz0dKC0tw=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-    wheel
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [ aiohttp ];
+  dependencies = [ aiohttp ];
 
   # Module has no tests
   doCheck = false;
@@ -37,8 +30,8 @@ buildPythonPackage rec {
   meta = {
     description = "Library to fetch data from QNAP QSW switches";
     homepage = "https://github.com/Noltari/aioqsw";
-    changelog = "https://github.com/Noltari/aioqsw/releases/tag/${version}";
-    license = with lib.licenses; [ asl20 ];
+    changelog = "https://github.com/Noltari/aioqsw/releases/tag/${src.tag}";
+    license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/atproto/default.nix b/pkgs/development/python-modules/atproto/default.nix
index b9a1c4b24b9b..87431ec4f33a 100644
--- a/pkgs/development/python-modules/atproto/default.nix
+++ b/pkgs/development/python-modules/atproto/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "atproto";
-  version = "0.0.63";
+  version = "0.0.65";
   format = "pyproject";
 
   # use GitHub, pypi does not include tests
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "MarshalX";
     repo = "atproto";
     tag = "v${version}";
-    hash = "sha256-ECqBlvKa0DK96AM0yJNuw2mq0SvZohPHFgxJ2jVHZ5s=";
+    hash = "sha256-0NogKxYO+lCtNhK2ZWwRLQTV7rHU5Oz+lnE4awsoPsM=";
   };
 
   POETRY_DYNAMIC_VERSIONING_BYPASS = version;
diff --git a/pkgs/development/python-modules/dashscope/default.nix b/pkgs/development/python-modules/dashscope/default.nix
index 5013d7ca9cf6..68ccb0225d1d 100644
--- a/pkgs/development/python-modules/dashscope/default.nix
+++ b/pkgs/development/python-modules/dashscope/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "dashscope";
-  version = "1.25.4";
+  version = "1.25.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dashscope";
     repo = "dashscope-sdk-python";
     tag = "v${version}";
-    hash = "sha256-Y9L7O+Q0V+Ru1sKDWxa7KntM/fJ3OUBsJQR82qrLFmw=";
+    hash = "sha256-HlztUCtLiDd2XztF3bUR411l1xuynYIErZHyWJUp/co=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/dbt-protos/default.nix b/pkgs/development/python-modules/dbt-protos/default.nix
index 425cd0b8f6cd..e868e99e6708 100644
--- a/pkgs/development/python-modules/dbt-protos/default.nix
+++ b/pkgs/development/python-modules/dbt-protos/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "dbt-protos";
-  version = "1.0.412";
+  version = "1.0.413";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dbt-labs";
     repo = "proto-python-public";
     tag = "v${version}";
-    hash = "sha256-Q9Pki95OaQKpBJn423/2DBLXHUWjpgOqTpJX3ASeXKs=";
+    hash = "sha256-WY8q06FyZliwdbIcLZPzpEpdxG6AeK+6EQU4bm8e4EE=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/elasticsearch8/default.nix b/pkgs/development/python-modules/elasticsearch8/default.nix
index 2ca5b6155b4d..c7f39a2a5f96 100644
--- a/pkgs/development/python-modules/elasticsearch8/default.nix
+++ b/pkgs/development/python-modules/elasticsearch8/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "elasticsearch8";
-  version = "8.19.2";
+  version = "8.19.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lDfI5RI8JgtZdmGDv9kVIGdyVChJtpf3inlEbsiQqA4=";
+    hash = "sha256-fv/pWzYCQbbVbvaCGQN6kK0PVnI2FNtUu+V9MwWEAvQ=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/falconpy/default.nix b/pkgs/development/python-modules/falconpy/default.nix
index 2526df18b003..79b3d37470ba 100644
--- a/pkgs/development/python-modules/falconpy/default.nix
+++ b/pkgs/development/python-modules/falconpy/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "falconpy";
-  version = "1.5.4";
+  version = "1.5.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CrowdStrike";
     repo = "falconpy";
     tag = "v${version}";
-    hash = "sha256-m/pW9M2HXTtu42UIOCq7J1lr+y9mc3N74lD+qaCjaVE=";
+    hash = "sha256-/ofAp4Hh+gj+2FSwQUI33OIo2iSBoOkbL9gB2F59YHw=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/fastcore/default.nix b/pkgs/development/python-modules/fastcore/default.nix
index 448a05333f71..94af8a7b0800 100644
--- a/pkgs/development/python-modules/fastcore/default.nix
+++ b/pkgs/development/python-modules/fastcore/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "fastcore";
-  version = "1.9.2";
+  version = "1.9.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fastai";
     repo = "fastcore";
     tag = version;
-    hash = "sha256-78zqQ8M0XZ6QcaH+6gw4IJDLk9d1WxjPiCr6puY/srM=";
+    hash = "sha256-7CnnvID4BCI53zrpXqaCu1ii+ZIE15BCbZGXtcfFkC0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/garth/default.nix b/pkgs/development/python-modules/garth/default.nix
index 6f8f4c71c07a..6d1dbe25da26 100644
--- a/pkgs/development/python-modules/garth/default.nix
+++ b/pkgs/development/python-modules/garth/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "garth";
-  version = "0.5.19";
+  version = "0.5.20";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-no9qxDtk6k5YXOEwFfwPJb4EylQRKOGorVIgvhwd4dY=";
+    hash = "sha256-dqn/SeLQMT+6XOr65hlavZf1zdHnICKm9VCFh9DMLpk=";
   };
 
   pythonRelaxDeps = [ "requests-oauthlib" ];
diff --git a/pkgs/development/python-modules/hcloud/default.nix b/pkgs/development/python-modules/hcloud/default.nix
index eb305ff79585..302c337b2460 100644
--- a/pkgs/development/python-modules/hcloud/default.nix
+++ b/pkgs/development/python-modules/hcloud/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "hcloud";
-  version = "2.12.0";
+  version = "2.13.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8UWxjvxtcP/z1IskTt/eKcD+Pd37utz+cdY/QfUkQfc=";
+    hash = "sha256-l0sio2w0fhE/+LJavSzThoARKISFGStWJynbprIjdeE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 4958b9730c56..e70b6af4c618 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "iamdata";
-  version = "0.1.202512221";
+  version = "0.1.202512241";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${version}";
-    hash = "sha256-IEFEynR5gLS9kdIMlytK1XKOawsnxsT+vWvLGZ6yd5g=";
+    hash = "sha256-q6spPE5sIQP2c/u4gbGIe4MOwM8dfQqg1cvAur1iD/k=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/lance-namespace-urllib3-client/default.nix b/pkgs/development/python-modules/lance-namespace-urllib3-client/default.nix
index 4598eb5ee540..5c83589693bd 100644
--- a/pkgs/development/python-modules/lance-namespace-urllib3-client/default.nix
+++ b/pkgs/development/python-modules/lance-namespace-urllib3-client/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "lance-namespace";
-  version = "0.3.2";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lancedb";
     repo = "lance-namespace";
     tag = "v${version}";
-    hash = "sha256-tBInz9BEl6u7E8cAmtlHBqIG65kifPR+iv5/jNV3204=";
+    hash = "sha256-t6VCKG54Sxf92B1OmfXXsWaJww2fyEcMGpJy4z94HZs=";
   };
 
   sourceRoot = "${src.name}/python/lance_namespace_urllib3_client";
diff --git a/pkgs/development/python-modules/lance-namespace/default.nix b/pkgs/development/python-modules/lance-namespace/default.nix
index e57b95a944c1..dacb8e124dc6 100644
--- a/pkgs/development/python-modules/lance-namespace/default.nix
+++ b/pkgs/development/python-modules/lance-namespace/default.nix
@@ -30,14 +30,14 @@
 
 buildPythonPackage rec {
   pname = "lance-namespace";
-  version = "0.3.2";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lancedb";
     repo = "lance-namespace";
     tag = "v${version}";
-    hash = "sha256-tBInz9BEl6u7E8cAmtlHBqIG65kifPR+iv5/jNV3204=";
+    hash = "sha256-t6VCKG54Sxf92B1OmfXXsWaJww2fyEcMGpJy4z94HZs=";
   };
 
   sourceRoot = "${src.name}/python/lance_namespace";
diff --git a/pkgs/development/python-modules/langchain-chroma/default.nix b/pkgs/development/python-modules/langchain-chroma/default.nix
index d8ff4c47f065..ecb321864727 100644
--- a/pkgs/development/python-modules/langchain-chroma/default.nix
+++ b/pkgs/development/python-modules/langchain-chroma/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-chroma";
-  version = "1.0.0";
+  version = "1.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-chroma==${version}";
-    hash = "sha256-fKFcl4NiNaypJGoV8bDrH7MwnsXNtnm7Hkxp/+SLc2c=";
+    hash = "sha256-WyW5QNLzbqI+kXIVCDyXLyqpShNOSk7tyBTdNoXGQZ0=";
   };
 
   sourceRoot = "${src.name}/libs/partners/chroma";
diff --git a/pkgs/development/python-modules/langchain-google-genai/default.nix b/pkgs/development/python-modules/langchain-google-genai/default.nix
index 5d41f44e971e..3871f30d7998 100644
--- a/pkgs/development/python-modules/langchain-google-genai/default.nix
+++ b/pkgs/development/python-modules/langchain-google-genai/default.nix
@@ -29,14 +29,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-google-genai";
-  version = "4.0.0";
+  version = "4.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain-google";
     tag = "libs/genai/v${version}";
-    hash = "sha256-SVwBJbHcoD8zqBr4r1uP35/gbWZxZsD0ygJuttCdTjY=";
+    hash = "sha256-PqJyT6Z6XpDvbexLlrrfeeycS4mXNR3vpWz3vSy+iac=";
   };
 
   sourceRoot = "${src.name}/libs/genai";
diff --git a/pkgs/development/python-modules/langchain-tests/default.nix b/pkgs/development/python-modules/langchain-tests/default.nix
index e3252f1e7939..6bb4125fba83 100644
--- a/pkgs/development/python-modules/langchain-tests/default.nix
+++ b/pkgs/development/python-modules/langchain-tests/default.nix
@@ -30,14 +30,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-tests";
-  version = "1.0.2";
+  version = "1.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-tests==${version}";
-    hash = "sha256-ke/nIvZRtwyeN5uQuqOjJ4KdE+cJOc9XkmDuT+nnZpQ=";
+    hash = "sha256-WJITm+8XIqezr/2U8HpE0J4hYdzg2Z6tw8b5s6SF6m0=";
   };
 
   sourceRoot = "${src.name}/libs/standard-tests";
diff --git a/pkgs/development/python-modules/langgraph-cli/default.nix b/pkgs/development/python-modules/langgraph-cli/default.nix
index 3233e6b47686..ff127e61c46c 100644
--- a/pkgs/development/python-modules/langgraph-cli/default.nix
+++ b/pkgs/development/python-modules/langgraph-cli/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "langgraph-cli";
-  version = "0.4.9";
+  version = "0.4.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = "cli==${version}";
-    hash = "sha256-qSKqxmypo9p3hcYTl2RtwqCw/+vYmu/HvnauEJi2zkU=";
+    hash = "sha256-sr3AtcrG9V0c5UBdSXyaX3bCxzrSONpY28L5jlomZuM=";
   };
 
   sourceRoot = "${src.name}/libs/cli";
diff --git a/pkgs/development/python-modules/langgraph-sdk/default.nix b/pkgs/development/python-modules/langgraph-sdk/default.nix
index 9873caff5b34..bb743b6addb3 100644
--- a/pkgs/development/python-modules/langgraph-sdk/default.nix
+++ b/pkgs/development/python-modules/langgraph-sdk/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "langgraph-sdk";
-  version = "0.2.15";
+  version = "0.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = "sdk==${version}";
-    hash = "sha256-+T7FBmsSAkteabmhDO475qO46bRJwyAammUBwX2Bo/g=";
+    hash = "sha256-64FlCtUz49KKQoz78NYMVaY3Wcy/AE/D7XGQW4gIMMg=";
   };
 
   sourceRoot = "${src.name}/libs/sdk-py";
diff --git a/pkgs/development/python-modules/langgraph/default.nix b/pkgs/development/python-modules/langgraph/default.nix
index 8693984000c1..b72307792d0d 100644
--- a/pkgs/development/python-modules/langgraph/default.nix
+++ b/pkgs/development/python-modules/langgraph/default.nix
@@ -40,14 +40,14 @@
 }:
 buildPythonPackage rec {
   pname = "langgraph";
-  version = "1.0.4";
+  version = "1.0.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = version;
-    hash = "sha256-Lo/Vq48j1my+GoZATKo3gByz5WJrFJEU7pelzfFfDLQ=";
+    hash = "sha256-QvnBb69JxOVfZ/22igX+WVatJNAUrHUrh3aIpztYmmc=";
   };
 
   postgresqlTestSetupPost = ''
diff --git a/pkgs/development/python-modules/leanblueprint/default.nix b/pkgs/development/python-modules/leanblueprint/default.nix
index 5a43d2388946..21ed95a96115 100644
--- a/pkgs/development/python-modules/leanblueprint/default.nix
+++ b/pkgs/development/python-modules/leanblueprint/default.nix
@@ -19,14 +19,14 @@
 }:
 buildPythonPackage {
   pname = "leanblueprint";
-  version = "0.0.19";
+  version = "0.0.20";
   pyproject = true;
 
   src = fetchFromGitHub {
     repo = "leanblueprint";
     owner = "PatrickMassot";
-    rev = "v0.0.19";
-    hash = "sha256-WARjzalYMvbw5IlhehRX+Na5aEmgM3HKy+s0x3GJNCY=";
+    rev = "v0.0.20";
+    hash = "sha256-jCNIf0pTO/7M4aLrbFyjGcTPmaIQnw32itKJdyCMn+g=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/libipld/default.nix b/pkgs/development/python-modules/libipld/default.nix
index b73571391af7..796c7c6b3849 100644
--- a/pkgs/development/python-modules/libipld/default.nix
+++ b/pkgs/development/python-modules/libipld/default.nix
@@ -18,19 +18,19 @@
 
 buildPythonPackage rec {
   pname = "libipld";
-  version = "3.2.0";
+  version = "3.3.2";
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
   # use pypi, GitHub does not include Cargo.lock
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZUIw/9k4Kl7sKKrU4Nzdk/Ed2H2mVpOdvxODB/KGcSA=";
+    hash = "sha256-foXM2RNhEOY5Q9lSMrGTyJPjacQGJz0jUWDlzEs5yc4=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
-    hash = "sha256-jVZ3Oml/W6Kb9hYEXazF3/ogFHtl43d1YLd8vZFJDa8=";
+    hash = "sha256-BtFIX6xCJWBkIOzYEr8XohA1jsXC9rhiaMd87pe101w=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/nibe/default.nix b/pkgs/development/python-modules/nibe/default.nix
index 5078046fcfa0..b0a5909c9633 100644
--- a/pkgs/development/python-modules/nibe/default.nix
+++ b/pkgs/development/python-modules/nibe/default.nix
@@ -12,23 +12,20 @@
   pytest-asyncio,
   pytestCheckHook,
   python-slugify,
-  pythonOlder,
   setuptools,
   tenacity,
 }:
 
 buildPythonPackage rec {
   pname = "nibe";
-  version = "2.19.0";
+  version = "2.20.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "yozik04";
     repo = "nibe";
     tag = version;
-    hash = "sha256-1Awf/7AUSsLo9O2GrVvdlHm5Fcj2CQ7TdKY152bogfQ=";
+    hash = "sha256-FeYM4UClx0qfv8QuDUBN3hc2MLVkmnnUC6+0wnywAuA=";
   };
 
   pythonRelaxDeps = [ "async-modbus" ];
@@ -63,7 +60,7 @@ buildPythonPackage rec {
   meta = {
     description = "Library for the communication with Nibe heatpumps";
     homepage = "https://github.com/yozik04/nibe";
-    changelog = "https://github.com/yozik04/nibe/releases/tag/${version}";
+    changelog = "https://github.com/yozik04/nibe/releases/tag/${src.tag}";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/python-owasp-zap-v2-4/default.nix b/pkgs/development/python-modules/python-owasp-zap-v2-4/default.nix
index e5b7046029c7..2ebcb6aa0d38 100644
--- a/pkgs/development/python-modules/python-owasp-zap-v2-4/default.nix
+++ b/pkgs/development/python-modules/python-owasp-zap-v2-4/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "python-owasp-zap-v2-4";
-  version = "0.4.0";
+  version = "0.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zaproxy";
     repo = "zap-api-python";
     tag = version;
-    hash = "sha256-UG8+0jJwnywvuc68/9r10kKMqxNIOg5mIdPt2Fx2BZA=";
+    hash = "sha256-8aZbnUoS9lrqM0XQg4PD/j1JFKzGh9dyzWF89Szdzao=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/python-sat/default.nix b/pkgs/development/python-modules/python-sat/default.nix
index 9f3b351c005d..9a983d763635 100644
--- a/pkgs/development/python-modules/python-sat/default.nix
+++ b/pkgs/development/python-modules/python-sat/default.nix
@@ -9,7 +9,7 @@
 }:
 buildPythonPackage rec {
   pname = "python-sat";
-  version = "1.8.dev24";
+  version = "1.8.dev25";
   pyproject = true;
 
   build-system = [ setuptools ];
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "python_sat";
-    hash = "sha256-f9NnaPcHdNNInWTvpkg91ieaYejJ29kAAOLcbnbDmM0=";
+    hash = "sha256-3eVCBXg95RyzMA8O8EOss1FKh+1EofnkKYJcVNuQAzY=";
   };
 
   preBuild = ''
diff --git a/pkgs/development/python-modules/validobj/default.nix b/pkgs/development/python-modules/validobj/default.nix
index 6f0d9b8555b0..e7f5193ca389 100644
--- a/pkgs/development/python-modules/validobj/default.nix
+++ b/pkgs/development/python-modules/validobj/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "validobj";
-  version = "1.3";
+  version = "1.5";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-tab3n3YGTcGk47Ijm/QOocT0zo10LJp4eEF094TJyzg=";
+    hash = "sha256-n2CEcZTPr57tbRhw5uFmcWZ1kHdBt2VzG/fS4+LDSyc=";
   };
 
   nativeBuildInputs = [ flit ];
diff --git a/pkgs/servers/http/angie/default.nix b/pkgs/servers/http/angie/default.nix
index 4fab1346b188..0c93f80766be 100644
--- a/pkgs/servers/http/angie/default.nix
+++ b/pkgs/servers/http/angie/default.nix
@@ -8,12 +8,12 @@
 }@args:
 
 callPackage ../nginx/generic.nix args rec {
-  version = "1.10.2";
   pname = "angie";
+  version = "1.10.3";
 
   src = fetchurl {
     url = "https://download.angie.software/files/angie-${version}.tar.gz";
-    hash = "sha256-pcKrk33ySoDnhq9WOJIvRuqKc9FhQYPIyQKYrocwlLg=";
+    hash = "sha256-/4IOydx6yLDoc8Ut3EizQX9QVPFXtdLfXBuO1637IlY=";
   };
 
   configureFlags = lib.optionals withAcme [
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-pyroscope-app/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-pyroscope-app/default.nix
index 36ba4275b5a2..04486f08f241 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-pyroscope-app/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-pyroscope-app/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "grafana-pyroscope-app";
-  version = "1.12.0";
-  zipHash = "sha256-Zxp/ebNEwcq/JRhSbtWsFWVY5mIGEexVnH/jtEnKXec=";
+  version = "1.14.2";
+  zipHash = "sha256-nRKsSPBfTN+CMrKMaV/ETM0CRxVrbkjici3mps19b/0=";
   meta = {
     description = "Integrate seamlessly with Pyroscope, the open-source continuous profiling platform, providing a smooth, query-less experience for browsing and analyzing profiling data";
     license = lib.licenses.agpl3Only;
diff --git a/pkgs/servers/web-apps/freshrss/default.nix b/pkgs/servers/web-apps/freshrss/default.nix
index 82a01ed0d9be..2a7a61924440 100644
--- a/pkgs/servers/web-apps/freshrss/default.nix
+++ b/pkgs/servers/web-apps/freshrss/default.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "FreshRSS";
-  version = "1.27.1";
+  version = "1.28.0";
 
   src = fetchFromGitHub {
     owner = "FreshRSS";
     repo = "FreshRSS";
     rev = version;
-    hash = "sha256-EpszwgYzobRA7LohtJJtgTefFAEmCXvcP3ilfsu+obo=";
+    hash = "sha256-//UiGxsdJQAc9qAn3P8/bCl8ka5LacfqkydU4b2/TtI=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/security/nitrokey-app2/default.nix b/pkgs/tools/security/nitrokey-app2/default.nix
index 384078074af1..b0f66d776454 100644
--- a/pkgs/tools/security/nitrokey-app2/default.nix
+++ b/pkgs/tools/security/nitrokey-app2/default.nix
@@ -22,14 +22,14 @@ in
 
 buildPythonApplication rec {
   pname = "nitrokey-app2";
-  version = "2.4.1";
+  version = "2.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Nitrokey";
     repo = "nitrokey-app2";
     tag = "v${version}";
-    hash = "sha256-nzhhtnKKOHA+Cw1y+BpYsyQklzkDnmFRKGIfaJ/dmaQ=";
+    hash = "sha256-mwcYjkyEP2itwdQ/xAG50uvw6zHfUacAecbDh86GNGA=";
   };
 
   nativeBuildInputs = [